aws/aws-cdk v2.222.0 on GitHub

bedrock-agentcore: The signature of RuntimeAuthorizerConfiguration.usingCognito() has changed to accept IUserPool and IUserPoolClient constructs instead of string parameters, and now supports multiple clients.

apigateway: add binaryMediaTypes property to SpecRestApi (#35502) (bf10d94), closes #35498
apigatewayv2: WebSocketStage support accessLogSettings (#34766) (dad112e), closes #21935
bedrock-agentcore: use IUserPool and IUserPoolClient interfaces instead of string identifiers (#35860) (a38afc9), closes #35854
core: IEnvironmentAware interface to retrieve a construct's environment (#35817) (8ee5d4b)
elasticloadbalancingv2: create security group settings for NLB by default (under feature flag) (#34675) (ff83cfd), closes #34606 /github.com/aws/aws-cdk/issues/34606#issuecomment-2931313249
events-targets: support Amazon Data Firehose target using Firehose's IDeliveryStream (#33798) (a374b6b), closes #33757 #33758
kinesisfirehose: add built-in data processors to decompress CloudWatch logs and extract messages (#33749) (5dec21e), closes #33691 #20242 /github.com/aws/aws-cdk/issues/33691#issuecomment-2713012245
lambda: add Java25 runtime for Lambda (#35867) (db71fac)
lambda: add Python 3.14 runtime for Lambda (#35869) (ebef303)
memory: add agentcore memory l2 construct (#35757) (6a2e17e)
msk: support Express brokers (#34741) (0a69e5f), closes #32923

agentcore: addToRolePolicy for runtime with imported role destroys and recreates policies on every deployment (#35842) (92525e4), closes #35844 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts#L253
agentcore: custom execution role policy for runtime lacks proper permissions (#35849) (ee94b63), closes #35852 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-artifact.ts#L65 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime.ts#L252-L259 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts#L693 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function.ts#L1468 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts#L1161
dynamodb: addToResourcePolicy has no effect (#35554) (94d7e34), closes #35062
ecs: remove empty CfnClusterCapacityProviderAssociations resource (#35783) (c8a131b), closes #35699 #35742
iam: cannot grant lambda:InvokeFunction on ManagedPolicy or Policy via grantInvoke() method (#32984) (a07d75a), closes #32980 /github.com/aws/aws-cdk/pull/32984#pullrequestreview-2863553504
compilation failure in Go (#35871) (5e4f603), closes aws/aws-cdk#35770 #35862
ec2: remove PassRole policy emitted by cloudwatch vpc flow destination (#35762) (c4b80df), closes #35729

Alpha modules (2.222.0-alpha.0)

bedrock-alpha: apply permission dependency to existing and non-existing roles (#35123) (b39ccf3), closes #35120
eks-v2-alpha: remove hyphen from Go package name (#35927) (2cdfc8a)